ROCHESTER, N.Y. — Transunion lied to you. That’s the word from the Consumer Financial Protection Bureau. The CFPB says in tens of thousands of cases, consumers locked or froze their accounts, but TransUnion took sometimes years to follow through, all the while indicating to consumers that their credit was secure.

Sir Walter Scott said it best.

“Oh, what tangled webs we weave when first we practice to deceive,” Scott says.

Leaders at the Consumer Financial Protection Bureau say when they discovered TransUnion’s deception, their web of lies had grown very tangled indeed. And caught in that web were tens of thousands of innocent consumers. If you got a loan for your car, your house, or you have a credit card, then you have a credit report. And three companies – Experian, Equifax and TransUnion have a record of every loan, late payment, and debt you owe. That’s why the Equifax breach in 2017 was such a big deal. Hackers stole the names, social security numbers, birthdates and addresses of 143 million Americans. In some cases, they got driver’s license numbers too.

So, in numerous investigative reports, Deanna Dewberry followed the advice of the New York Attorney General and countless financial advisors, telling you to freeze your credit report with all three bureaus. And millions of Americans did just that.

In its court filing against TransUnion, the Consumer Financial Protection Bureau notes that in the two months before the Equifax breach, TransUnion got just over 33,000 requests to freeze consumers’ credit reports. In the two months after the breach, it got well over two million requests.

But the CFPB says TransUnion’s systems didn’t work well. And since 2003, “TransUnion failed to place or remove security freezes and locks on the credit reports of tens of thousands of consumers in a timely manner,” leaving them exposed to identity thieves. So, the CFPB has ordered TransUnion to deposit $3 million in an account to pay back consumers and pay a civil penalty of $5 million.

By law, if you contact the credit bureaus online or by phone, they’re supposed to freeze your credit report in one business day. If you contact them by mail, they have three business days. But the CFPB says sometimes they took days, months, even years to freeze the credit for tens of thousands of people.

We all need to check our credit reports with a keen eye on the TransUnion report to make sure no thief has opened a line of credit in your name. As for victims of what the CFPB says is TransUnion’s web of lies, you don’t have to file a claim. The CFPB will oversee identifying victims and paying them restitution.